@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.3

package/src/cli.js

@@ -11,6 +11,7 @@ import { printContextSummary } from './lib/detect-context.js';
 import { runStartLocal } from './commands/start-local.js';
 import { runOllama } from './commands/ollama.js';
 import { runModels } from './commands/models.js';
+import { runApp } from './commands/app.js';
 import { runProviders } from './commands/providers.js';
 import { runEnv } from './commands/env.js';
 import { runTunnel } from './commands/tunnel.js';
@@ -23,6 +24,8 @@ import { runDb } from './commands/db.js';
 import { runStatus } from './commands/status.js';
 import { runInteractive } from './commands/interactive.js';
 import { runShell } from './commands/shell.js';
+import { runGoap } from './commands/goap.js';
+import { runBrand, runPlan } from './commands/brand.js';
 import { runDockerize } from './commands/dockerize.js';
 import { runMini } from './commands/mini.js';
 import { runMerkle } from './commands/merkle.js';
@@ -32,10 +35,13 @@ import { runRecon } from './commands/recon.js';
 import { runCad } from './commands/cad.js';
 import { runSkills } from './commands/skills.js';
 import { runEval } from './commands/eval.js';
+import { runMcp } from './commands/mcp.js';
 import { runCloudflare } from './commands/cloudflare.js';
+import { runGo } from './commands/go.js';
 import { runWhoami } from './commands/whoami.js';
 import { runResume } from './commands/resume.js';
 import { runLogin, runLogout } from './commands/account-auth.js';
+import { runPlugins } from './commands/plugins.js';
 import { applyPresetSelection, runAdd, runCapabilities, runDev, runInspect } from './commands/product.js';
 import { listPresets, resolvePreset } from './presets/index.js';
 import fs from 'node:fs';
@@ -43,6 +49,7 @@ import { repositoryRoot } from './knowledge/config.js';
 import { resolveAccountAuth } from './lib/account-session.js';
 import { renderDiagnosticError } from './errors/index.js';
 import { renderHelpOverview, runHelp } from './ui/cli/help.js';
+import { hydrateSecureCredentials } from './security/local-vault.js';
 
 const VERSION = pkg.version;
 
@@ -65,8 +72,11 @@ function printLegacyHelp() {
     agentsam                     Enter the interactive Agent Sam experience
     agentsam create <name> --preset <fullstack|cms|prototype|data>
     agentsam add <auth|cms|knowledge|agent|deploy-cloudflare>
+    agentsam plugins list|install|connect|status|remove [@agentsam-mcp]
     agentsam dev               Run this project's existing npm dev script
     agentsam inspect [--json]  Bounded repository index by default; use --view full for authority envelope
+    agentsam brand [scan|…]    Deterministic brand intelligence on repository.snapshot authority
+    agentsam plan brand        Composable brand normalization plan (--goap optional)
     agentsam deploy            Graduate an AgentSam project intentionally
 
   Capability discovery:
@@ -80,12 +90,13 @@ function printLegacyHelp() {
     agentsam search "query"    Retrieve indexed code/text; --semantic enables embeddings
     agentsam repo snapshot     Git composition/churn; --save retains observations
     agentsam cad blender       Programmatic Blender inspect/build/render/export (--help)
+    agentsam cad project       Editable CAD project tools/workflows (--help)
     agentsam mini <name>       Create and preview a small local gadget (--help for options)
     agentsam merkle            File integrity, snapshots, comparisons, and interactive explorer (--help)
     agentsam deploy-receipt    Merkle deploy/checkpoint capture + promote/failure receipts (--help)
     agentsam recon             Bounded-worker task packets + finding-report validation (--help)
     agentsam security          Dependency scan, log triage, and verified repair (--help)
-    agentsam status [--json]   Live local Git + DB + API + PTY status
+    agentsam status [--json] [-i]   Honest awareness: account + models + terminal + live Worker
     agentsam db init|status    Manage the project-local SQLite database
     agentsam models            Verify configured providers and selectable hosted/local models
     agentsam providers         Configure, verify, and remove machine provider credentials
@@ -96,14 +107,16 @@ function printLegacyHelp() {
     agentsam resume [session]  Resume a saved Agent Sam session; omit id for picker
     agentsam eval context      Offline context-strategy/economics fixtures (--help)
     agentsam cloudflare        Native Wrangler reads + Worker CPU profile analysis (--help)
+    agentsam go                Go runtime discovery/build/deploy (Cloudflare worker-container)
     agentsam start-local       Local PTY on ws://127.0.0.1:3099 (no tunnel, no Cloudflare)
     agentsam ollama            Opt-in local Ollama setup/status/model management
     agentsam shell             Interactive Agent Sam slash-command shell
-    agentsam tunnel            Explicitly expose local PTY when remote access is wanted
+    agentsam tunnel            Choose/list/inspect/run real Cloudflare Tunnels via Wrangler
     agentsam deploy            Graduate to Cloudflare / GCP when ready
     agentsam dockerize         Build/run app, knowledge, or CAD containers (--help)
     agentsam identity preview  Preview the reusable local auth portal (not production login)
-    agentsam identity init     Add reusable identity package surfaces
+    agentsam identity init     Scaffold identity app (+ optional --provider)
+    agentsam identity providers|plan|schema|resolve  Protocol-driven identity surfaces
     agentsam help
     agentsam --version
     agentsam --help
@@ -131,11 +144,13 @@ function printLegacyHelp() {
   Run agentsam from any project to enter the account-aware interactive experience.
   Account, model-provider, terminal, and deploy permissions are requested only when the related capability needs them.
 
-  Tunnel options:
-    --quick                    Quick tunnel (default) — trycloudflare.com URL
-    --named                    Named CF tunnel (needs --tunnel-name --hostname --zone-id)
-    --port <n>                 Local PTY port (default 3099)
-    --token <aak_…>            Use AGENTSAM_API_KEY-compatible account credential
+  Tunnel commands:
+    agentsam tunnel            Guided picker over Wrangler-visible tunnels
+    agentsam tunnel list       List real Cloudflare Tunnels
+    agentsam tunnel info <id>  Inspect one tunnel
+    agentsam tunnel run <id>   Run/start a connector on this machine
+    agentsam tunnel create <name>
+    agentsam tunnel quick-start [url]
 
   Init options:
     --name <name>              Project directory name
@@ -300,6 +315,8 @@ async function initFromArgs(argv) {
 const command = process.argv[2];
 const rest = process.argv.slice(3);
 
+hydrateSecureCredentials(process.env);
+
 if (command === '--version' || command === '-v') {
   console.log(VERSION);
 } else if (command === 'help') {
@@ -333,6 +350,12 @@ if (command === '--version' || command === '-v') {
 } else if (command === 'add') {
   try { await runAdd(rest); }
   catch (e) { reportCliError(e); process.exitCode = 1; }
+} else if (command === 'plugins') {
+  try { await runPlugins(rest); }
+  catch (e) { reportCliError(e); process.exitCode = 1; }
+} else if (command === 'install' && rest[0] === 'plugins') {
+  try { await runPlugins(['install', rest[1] || 'agentsam-mcp', ...rest.slice(2)]); }
+  catch (e) { reportCliError(e); process.exitCode = 1; }
 } else if (command === 'dev') {
   try { await runDev(rest); }
   catch (e) { reportCliError(e); process.exitCode = 1; }
@@ -370,6 +393,13 @@ if (command === '--version' || command === '-v') {
     reportCliError(e);
     process.exit(1);
   }
+} else if (command === 'app' || command === 'apps') {
+  try {
+    await runApp(rest);
+  } catch (e) {
+    reportCliError(e);
+    process.exit(1);
+  }
 } else if (command === 'providers') {
   try {
     await runProviders(rest);
@@ -391,6 +421,13 @@ if (command === '--version' || command === '-v') {
     reportCliError(e);
     process.exit(1);
   }
+} else if (command === 'mcp') {
+  try {
+    await runMcp(rest);
+  } catch (e) {
+    reportCliError(e);
+    process.exitCode = 1;
+  }
 } else if (command === 'cloudflare' || command === 'cf') {
   try {
     await runCloudflare(rest);
@@ -398,6 +435,13 @@ if (command === '--version' || command === '-v') {
     if (!e?.reported) reportCliError(e);
     process.exitCode = 1;
   }
+} else if (command === 'go') {
+  try {
+    await runGo(rest);
+  } catch (e) {
+    if (!e?.reported) reportCliError(e);
+    process.exitCode = 1;
+  }
 } else if (command === 'login') {
   try {
     await runLogin(rest);
@@ -433,6 +477,30 @@ if (command === '--version' || command === '-v') {
     reportCliError(e);
     process.exit(1);
   }
+} else if (command === 'goap') {
+  try {
+    await runGoap(rest[0], {
+      cwd: process.cwd(),
+      json: rest.includes('--json'), args: rest.slice(1),
+    });
+  } catch (e) {
+    reportCliError(e);
+    process.exitCode = 1;
+  }
+} else if (command === 'brand') {
+  try {
+    await runBrand(rest);
+  } catch (e) {
+    reportCliError(e);
+    process.exitCode = 1;
+  }
+} else if (command === 'plan') {
+  try {
+    await runPlan(rest);
+  } catch (e) {
+    reportCliError(e);
+    process.exitCode = 1;
+  }
 } else if (command === 'start-local') {
   await runStartLocal({});
 } else if (command === 'ollama') {
@@ -499,6 +567,9 @@ if (command === '--version' || command === '-v') {
     reportCliError(e);
     process.exitCode = 1;
   }
+} else if (command === 'autorag') {
+  try { await (await import('./commands/autorag.js')).runAutoRag(rest); }
+  catch (e) { reportCliError(e); process.exitCode = 1; }
 } else if (['index', 'search', 'repo'].includes(command)) {
   try {
     const commands = await import('./commands/knowledge.js');
@@ -514,6 +585,7 @@ if (command === '--version' || command === '-v') {
   } catch (e) { reportCliError(e); process.exitCode = 1; }
 } else if (command === 'identity') {
   const sub = rest[0];
+  const identityProtocol = await import('./commands/identity-protocol.js');
   if (sub === 'preview') {
     try {
       await runIdentityPreview(rest.slice(1));
@@ -528,8 +600,44 @@ if (command === '--version' || command === '-v') {
       reportCliError(e);
       process.exit(1);
     }
+  } else if (sub === 'providers') {
+    try {
+      await identityProtocol.runIdentityProviders(rest.slice(1));
+    } catch (e) {
+      reportCliError(e);
+      process.exit(1);
+    }
+  } else if (sub === 'plan') {
+    try {
+      await identityProtocol.runIdentityPlan(rest.slice(1));
+    } catch (e) {
+      reportCliError(e);
+      process.exit(1);
+    }
+  } else if (sub === 'schema') {
+    try {
+      await identityProtocol.runIdentitySchema(rest.slice(1));
+    } catch (e) {
+      reportCliError(e);
+      process.exit(1);
+    }
+  } else if (sub === 'resolve') {
+    try {
+      await identityProtocol.runIdentityResolve(rest.slice(1));
+    } catch (e) {
+      reportCliError(e);
+      process.exit(1);
+    }
   } else {
-    console.error('\n  Usage:\n    agentsam identity preview [--open] [--port 8791]\n    agentsam identity init --name <project> [--brand "Name"]\n');
+    identityProtocol.printIdentityHelp();
+    process.exit(1);
+  }
+} else if (command === 'scaffold') {
+  try {
+    const { runScaffold } = await import('./lib/scaffold/index.js');
+    await runScaffold(rest[0] ?? null);
+  } catch (e) {
+    reportCliError(e);
     process.exit(1);
   }
 } else {

package/src/cloudflare/index.js

@@ -6,6 +6,12 @@ export {
   parseWranglerErrorEvidence,
   runWranglerNative,
 } from './wrangler.js';
+export {
+  readCloudflareDeploymentContract,
+  collectCloudflareDeploymentStatus,
+  parseWranglerToml,
+  resolveProjectD1Database,
+} from './runtime-status.js';
 export {
   summarizeCloudflareCpuProfile,
   summarizeCloudflareCpuProfileFile,

package/src/cloudflare/runtime-status.js

@@ -0,0 +1,393 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { runWranglerNative } from './wrangler.js';
+
+function clean(value) { return value == null ? '' : String(value).trim(); }
+
+function parseJsonc(source) {
+  let output = '';
+  let string = false;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    const next = source[index + 1];
+    if (lineComment) {
+      if (char === '\n') { lineComment = false; output += char; }
+      continue;
+    }
+    if (blockComment) {
+      if (char === '*' && next === '/') { blockComment = false; index += 1; }
+      continue;
+    }
+    if (string) {
+      output += char;
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') string = false;
+      continue;
+    }
+    if (char === '"') { string = true; output += char; continue; }
+    if (char === '/' && next === '/') { lineComment = true; index += 1; continue; }
+    if (char === '/' && next === '*') { blockComment = true; index += 1; continue; }
+    output += char;
+  }
+  return JSON.parse(output.replace(/,\s*([}\]])/g, '$1'));
+}
+
+export function parseWranglerToml(source = '') {
+  const result = { vars: {}, d1_databases: [], r2_buckets: [], hyperdrive: [], kv_namespaces: [], services: [] };
+  const lines = source.split(/\r?\n/);
+  let currentSection = '';
+  let currentBlock = null;
+
+  for (let line of lines) {
+    line = line.replace(/#.*$/, '').trim();
+    if (!line) continue;
+
+    const arrMatch = line.match(/^\[\[([a-zA-Z0-9_.]+)\]\]$/);
+    if (arrMatch) {
+      currentSection = arrMatch[1];
+      currentBlock = {};
+      if (currentSection === 'd1_databases') result.d1_databases.push(currentBlock);
+      else if (currentSection === 'r2_buckets') result.r2_buckets.push(currentBlock);
+      else if (currentSection === 'hyperdrive') result.hyperdrive.push(currentBlock);
+      else if (currentSection === 'kv_namespaces') result.kv_namespaces.push(currentBlock);
+      else if (currentSection === 'services') result.services.push(currentBlock);
+      continue;
+    }
+
+    const tableMatch = line.match(/^\[([a-zA-Z0-9_.]+)\]$/);
+    if (tableMatch) {
+      currentSection = tableMatch[1];
+      currentBlock = null;
+      if (currentSection === 'ai' && !result.ai) result.ai = {};
+      if (currentSection === 'assets' && !result.assets) result.assets = {};
+      continue;
+    }
+
+    const kvMatch = line.match(/^([a-zA-Z0-9_.-]+)\s*=\s*(.*)$/);
+    if (kvMatch) {
+      const key = kvMatch[1].trim();
+      let rawVal = kvMatch[2].trim();
+      let val = rawVal;
+      if ((rawVal.startsWith('"') && rawVal.endsWith('"')) || (rawVal.startsWith("'") && rawVal.endsWith("'"))) {
+        val = rawVal.slice(1, -1);
+      } else if (rawVal === 'true') {
+        val = true;
+      } else if (rawVal === 'false') {
+        val = false;
+      } else if (/^\d+$/.test(rawVal)) {
+        val = parseInt(rawVal, 10);
+      }
+
+      if (currentBlock) {
+        currentBlock[key] = val;
+      } else if (currentSection === 'vars') {
+        result.vars[key] = val;
+      } else if (currentSection === 'ai') {
+        result.ai[key] = val;
+      } else if (currentSection === 'assets') {
+        result.assets[key] = val;
+      } else if (!currentSection) {
+        result[key] = val;
+      }
+    }
+  }
+  return result;
+}
+
+function declaredBindings(config = {}) {
+  const rows = [];
+  const add = (row = {}) => {
+    const name = clean(row.name);
+    if (name) rows.push({ ...row, name });
+  };
+
+  for (const [name, value] of Object.entries(config.vars || {})) {
+    add({
+      name,
+      type: typeof value === 'object' && value !== null ? 'json' : 'plain_text',
+      value: typeof value === 'object' && value !== null ? JSON.stringify(value) : String(value),
+      source: 'wrangler_config',
+    });
+  }
+
+  for (const name of config.secrets?.required || []) {
+    add({ name, type: 'secret_text', encrypted: true, source: 'wrangler_required_secret' });
+  }
+
+  for (const row of config.d1_databases || []) add({
+    name: row?.binding,
+    type: 'd1',
+    database_name: clean(row?.database_name) || null,
+    database_id: clean(row?.database_id) || null,
+    source: 'wrangler_config',
+  });
+  for (const row of config.hyperdrive || []) add({
+    name: row?.binding,
+    type: 'hyperdrive',
+    id: clean(row?.id) || null,
+    source: 'wrangler_config',
+  });
+  for (const row of config.r2_buckets || []) add({
+    name: row?.binding,
+    type: 'r2_bucket',
+    bucket_name: clean(row?.bucket_name) || null,
+    source: 'wrangler_config',
+  });
+  for (const row of config.services || []) add({
+    name: row?.binding,
+    type: 'service',
+    service: clean(row?.service) || null,
+    environment: clean(row?.environment) || null,
+    entrypoint: clean(row?.entrypoint) || null,
+    source: 'wrangler_config',
+  });
+  for (const row of config.vpc_services || []) add({
+    name: row?.binding,
+    type: 'vpc_service',
+    service_id: clean(row?.service_id) || null,
+    source: 'wrangler_config',
+  });
+  if (config.ai?.binding) add({ name: config.ai.binding, type: 'ai', source: 'wrangler_config' });
+  if (config.assets?.binding) add({
+    name: config.assets.binding,
+    type: 'assets',
+    directory: clean(config.assets?.directory) || null,
+    source: 'wrangler_config',
+  });
+  for (const row of config.kv_namespaces || []) add({
+    name: row?.binding,
+    type: 'kv_namespace',
+    id: clean(row?.id) || null,
+    source: 'wrangler_config',
+  });
+  for (const row of config.vectorize || []) add({
+    name: row?.binding,
+    type: 'vectorize',
+    index_name: clean(row?.index_name) || null,
+    source: 'wrangler_config',
+  });
+  const queueProducers = Array.isArray(config.queues?.producers) ? config.queues.producers : [];
+  for (const row of queueProducers) add({
+    name: row?.binding,
+    type: 'queue',
+    queue_name: clean(row?.queue) || null,
+    source: 'wrangler_config',
+  });
+
+  return rows.sort((left, right) => left.name.localeCompare(right.name));
+}
+
+function safeLiveBinding(row = {}) {
+  const name = clean(row?.name);
+  const type = clean(row?.type);
+  if (!name) return null;
+
+  const output = { name, type: type || 'unknown', source: 'cloudflare_live_version' };
+  if (type === 'secret_text' || type === 'secret_key') {
+    output.encrypted = true;
+    return output;
+  }
+
+  if (type === 'plain_text') {
+    const value = row?.text ?? row?.value;
+    if (value != null) output.value = String(value);
+  } else if (type === 'json') {
+    const value = row?.json ?? row?.value;
+    if (value != null) output.value = typeof value === 'string' ? value : JSON.stringify(value);
+  }
+
+  for (const key of [
+    'id',
+    'database_id',
+    'database_name',
+    'bucket_name',
+    'service',
+    'environment',
+    'entrypoint',
+    'service_id',
+    'index_name',
+    'namespace',
+    'class_name',
+    'script_name',
+    'store_id',
+    'secret_name',
+  ]) {
+    const value = row?.[key];
+    if (value != null && clean(value)) output[key] = clean(value);
+  }
+
+  return output;
+}
+
+function bindingCategory(row = {}) {
+  const type = clean(row?.type);
+  if (type === 'secret_text' || type === 'secret_key') return 'secret';
+  if (type === 'plain_text' || type === 'json') return 'variable';
+  return 'resource';
+}
+
+export function readCloudflareDeploymentContract(root, projectConfig = {}) {
+  const deployment = projectConfig?.deployment?.cloudflare || {};
+  let workerName = clean(deployment.worker_name);
+  let relativeConfig = clean(deployment.config);
+  let configPath = relativeConfig ? path.resolve(root, relativeConfig) : null;
+
+  // Auto-discover candidate wrangler config when not explicitly specified
+  if (!workerName && !configPath) {
+    const candidates = [
+      'wrangler.jsonc',
+      'wrangler.json',
+      'wrangler.toml',
+      'backend/wrangler.jsonc',
+      'backend/wrangler.json',
+      'backend/wrangler.toml',
+      'worker/wrangler.jsonc',
+      'worker/wrangler.json',
+      'worker/wrangler.toml',
+      'apps/local-studio/backend/wrangler.jsonc',
+    ];
+    for (const rel of candidates) {
+      const candidatePath = path.resolve(root, rel);
+      if (fs.existsSync(candidatePath)) {
+        try {
+          const raw = fs.readFileSync(candidatePath, 'utf8');
+          const parsed = rel.endsWith('.toml') ? parseWranglerToml(raw) : parseJsonc(raw);
+          if (clean(parsed?.name)) {
+            workerName = clean(parsed.name);
+            relativeConfig = rel;
+            configPath = candidatePath;
+            break;
+          }
+        } catch {
+          // ignore candidate error
+        }
+      }
+    }
+  }
+
+  if (!workerName && !configPath) return { configured: false, worker_name: null, config: null, bindings: [], routes: [], health_url: null };
+  if (!workerName || !configPath) throw new Error('cloudflare_deployment_contract_incomplete');
+  if (configPath !== path.resolve(root) && !configPath.startsWith(`${path.resolve(root)}${path.sep}`)) throw new Error('cloudflare_deployment_config_outside_project');
+  const rawSource = fs.readFileSync(configPath, 'utf8');
+  const parsed = configPath.endsWith('.toml') ? parseWranglerToml(rawSource) : parseJsonc(rawSource);
+  if (clean(parsed.name) !== workerName) throw new Error(`cloudflare_worker_name_mismatch:${workerName}:${clean(parsed.name) || 'missing'}`);
+  const routes = (parsed.routes || []).map((row) => typeof row === 'string' ? row : clean(row?.pattern)).filter(Boolean);
+  const customDomain = routes.find((value) => !value.includes('*')) || '';
+  return {
+    configured: true,
+    worker_name: workerName,
+    config: relativeConfig,
+    config_path: configPath,
+    bindings: declaredBindings(parsed),
+    routes,
+    health_url: clean(deployment.health_url) || (customDomain ? `https://${customDomain}/health` : null),
+  };
+}
+
+export function resolveProjectD1Database(root = process.cwd()) {
+  try {
+    const contract = readCloudflareDeploymentContract(root);
+    if (contract?.bindings) {
+      const dbBinding = contract.bindings.find((b) => b.name === 'DB' && b.type === 'd1')
+        || contract.bindings.find((b) => b.type === 'd1');
+      if (dbBinding) {
+        return clean(dbBinding.database_name) || clean(dbBinding.name) || '';
+      }
+    }
+  } catch {
+    // ignore
+  }
+  return clean(process.env.DB) || '';
+}
+
+function newest(rows = [], dateAt) {
+  return [...rows].sort((left, right) => Date.parse(dateAt(right) || 0) - Date.parse(dateAt(left) || 0))[0] || null;
+}
+
+async function probeHealth(url, fetchImpl) {
+  if (!url) return { configured: false, ok: null, status: null, url: null, data: null, error: null };
+  try {
+    const response = await fetchImpl(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(8_000) });
+    const data = await response.json().catch(() => null);
+    return { configured: true, ok: response.ok && data?.ok !== false, status: response.status, url, data, error: null };
+  } catch (error) {
+    return { configured: true, ok: false, status: null, url, data: null, error: error?.message || String(error) };
+  }
+}
+
+export async function collectCloudflareDeploymentStatus(options = {}) {
+  const root = path.resolve(options.root || options.cwd || process.cwd());
+  let contract;
+  try {
+    contract = readCloudflareDeploymentContract(root, options.projectConfig || {});
+  } catch (error) {
+    return { configured: true, connected: false, contract_error: error?.message || String(error), worker_name: null, bindings: null, health: null, error: 'deployment_contract_invalid' };
+  }
+  if (!contract.configured) return { ...contract, connected: false, offline: options.offline === true, bindings: null, health: null, error: null };
+  if (options.offline === true) return { ...contract, connected: false, offline: true, bindings: null, health: null, error: null };
+
+  const runner = options.runWrangler || runWranglerNative;
+  const base = { cwd: root, config: contract.config, name: contract.worker_name };
+  try {
+    const [identity, deployments, versions, health] = await Promise.all([
+      runner('whoami', base),
+      runner('deployments.list', base),
+      runner('versions.list', base),
+      probeHealth(contract.health_url, options.fetchImpl || fetch),
+    ]);
+    const deploymentRows = Array.isArray(deployments?.data) ? deployments.data : [];
+    const versionRows = Array.isArray(versions?.data) ? versions.data : [];
+    const activeDeployment = newest(deploymentRows, row => row?.created_on);
+    const activeVersionId = clean(activeDeployment?.versions?.find((row) => Number(row?.percentage) === 100)?.version_id)
+      || clean(newest(versionRows, row => row?.metadata?.created_on)?.id);
+    const version = activeVersionId ? await runner('versions.view', { ...base, version_id: activeVersionId }) : null;
+    const rawLiveBindings = Array.isArray(version?.data?.resources?.bindings)
+      ? version.data.resources.bindings
+      : Array.isArray(version?.data?.bindings)
+        ? version.data.bindings
+        : [];
+    const liveBindings = rawLiveBindings.map(safeLiveBinding).filter(Boolean);
+    const liveByName = new Map(liveBindings.map((row) => [row.name, row]));
+    const missing = contract.bindings.filter((row) => !liveByName.has(row.name));
+    const typeMismatches = contract.bindings.filter((row) => liveByName.has(row.name) && liveByName.get(row.name).type !== row.type)
+      .map((row) => ({ name: row.name, declared: row.type, live: liveByName.get(row.name).type }));
+    const runtimeVariables = liveBindings.filter((row) => bindingCategory(row) === 'variable');
+    const runtimeSecrets = liveBindings.filter((row) => bindingCategory(row) === 'secret');
+    const resourceBindings = liveBindings.filter((row) => bindingCategory(row) === 'resource');
+    return {
+      ...contract,
+      connected: true,
+      offline: false,
+      identity: identity?.data ? {
+        logged_in: identity.data.loggedIn === true,
+        auth_type: identity.data.authType || null,
+        accounts: (identity.data.accounts || []).map((row) => ({ id: row?.id || null, name: row?.name || null, type: row?.type || null })),
+      } : null,
+      deployment: activeDeployment,
+      version: version?.data ? {
+        id: version.data.id || activeVersionId,
+        number: version.data.number ?? null,
+        created_on: version.data.metadata?.created_on || null,
+        source: version.data.metadata?.source || null,
+      } : null,
+      bindings: {
+        declared: contract.bindings,
+        live: liveBindings,
+        runtime_variables: runtimeVariables,
+        runtime_secrets: runtimeSecrets,
+        resources: resourceBindings,
+        missing,
+        type_mismatches: typeMismatches,
+        match: missing.length === 0 && typeMismatches.length === 0,
+      },
+      health,
+      error: null,
+    };
+  } catch (error) {
+    return { ...contract, connected: false, offline: false, bindings: null, health: await probeHealth(contract.health_url, options.fetchImpl || fetch), error: error?.message || String(error) };
+  }
+}